P2P settlement factory expects £10 million from… mailing letters

Thanks to a data leak, we've seen the spreadsheets, the salary charts, the …

Andrew Crossley, the lawyer behind the UK's leading P2P settlement factory, is serious about mailing out his "pay up" letters, and he knows just what kind of return he'll get. As part of firm's huge e-mail leak (read our major investigation), Ars has now seen the company's "strictly private and confidential" business plan, along with detailed cash flow projections and salary statements. After poring over the data for the last few days, it's possible to say just how Crossley makes his money—and how much of it he makes.

Crossley's law firm, ACS Law, helps pornographers (and a few music labels and software publishers) defend their copyrighted works online, and after doing it for a while, Crossley has the business down to a science. According to a cash flow projection spreadsheet, the amount of money demanded in the letters varies by client. For instance, a campaign on behalf of Mediacat demanded £500, while another campaign for Digiprotect only asked for £400. "Lucky" targets of this scheme might be asked to pay just £350.

But how can Crossley have any idea who will settle and who won't? Given the volume business he's engaged in, this is really just a numbers game. ACS Law's business plan assumes a 15 percent recovery rate, but "in practice, we area able to demonstrate a 20 percent recovery rate."

A couple hundred pounds and a low response rate might not sound like the road to riches, but if you mail a lot of letters, it adds up quickly (and ACS Law will happily put people on an installment plan if they can't pay up right away). And Crossley does mail a lot of letters; his business plan notes that ACS Law has "invested in a high quality commercial printer to ensure it has sufficient capacity. In addition, it always keep [sic] another printer on site in case the main printer experiences any difficulties."

Crossley's spreadsheets show that a tiny campaign might snag 12,000 suspected IP addresses, only 3,550 of which are "usable." Of these 3,550, only 1,598 were turned into letters. With a 15 percent response rate and a demand for £400, this campaign is expected to pull in £81,000 pounds.

(Note that the raw data supplied by P2P detection companies is largely unusable. Only 40 percent of the IP addresses turned over to ACS Law can be used, and only 45 percent of these can actually be turned into usable names and addresses.)

Larger campaigns have sent up to 13,500 letters at once—a move projected to bring in a whopping £602,000 in gross revenue.

Details from six waves of letters

This doesn't all go to ACS Law, of course. Fifteen percent is set aside to pay ISPs for doing the actual IP address lookups, while the copyright holder and the P2P detection firm each get a big chunk. But ACS Law does well for itself; according to the business plan and the spreadsheets we reviewed, the law firm keeps "between 35 and 53 percent of net revenues" for itself.

In one spreadsheet, Crossley tots up his total projected income from 2010 and 2011; according to these calculations, his approach will rake in £10,235,700 of gross revenue by the end of 2011. After ACS Law pays its data supplier and the copyright holders, Crossley & Co. should be left with £4,261,585 of their own.

Expenses

Now, Crossley has expenses, of course. He keeps an office in Westminster, London. He employs a staff of 19 paralegals, five administrators, and a few supervisors. He has to pay for all that paper he uses to print his letters—believe it or not, paper costs Crossley more each year (£31,000) than he pays in salary to any one of his employees.

But these costs are minimal. Crossley pays his administrators only £13,500 a year, his paralegals get £16,000, and no one makes above £20,000. Rent is £6,000 a month. Each month, his total expenses come to just about £50,000, or £600,000 for an entire year.

So let's run the numbers. For 2010 and 2011, Crossley expects his firm's share to be £4,261,585, but he only has a total of £1,200,000 in expenses. Raw profit in Crossley's own pocket: £3,177,722. Nice work if you can get it, and it explains why he's been looking for a mansion to rent and buying a Bentley and a new Jeep.

Pure profit

Unfortunately for Crossley, much of this cash flow projection is speculative. As he notes in one e-mail, "The figures in reality have not yet matched these projected figures for one reason only; we are still awaiting a large amount of names and addresses from the ISPs to enable us to send our letters. However, from the letters we have been able to send out the figures have come in exactly as we have predicted... But for the delay in the data from the ISPs, which is temporary, all facts and matters stated in the business plan still prevail."

His recent loss of all these e-mails may put another big dent in his plans, thanks to data privacy laws. By losing the spreadsheets showing what UK citizen allegedly downloaded what, Crossley may have put himself at risk of a £500,000 fine.

The UK's Information Commissioner put out a statement today noting that "any organisation processing personal data must ensure that it is kept safe and secure. This is an important principle of the Act. The ICO will be contacting ACS Law to establish further facts of the case and to identify what action, if any, needs to be taken."

The Commissioner cares because the leak contained spreadsheets, like the one below from BT, showing just whose account was associated with a particular IP address—and a particular pornographic movie.

A portion of BT's infringer list

When BT turned over this data to ACS Law, it noted in an e-mail, "Please acknowledge safe receipt and that the data will be held securely and shall be used only in accordance with the provisions of the Order." But the spreadsheet that we saw wasn't even password-protected.

Still, unless the government or the judiciary shuts him down completely, not even a massive fine will mean much, so long as Crossley can turn his cash flow projections into reality.

If 4chan really wants to put a dent in this guy, they should mass mail out letters to everyone on the list with a note that says, "They won't take you to court. This is a shakedown. Just ignore their letters." If ACS' whole business model revolves around settlement offers, this would tank them.

"Party Babes" was really popular, it seems. Only one listing for "The Uranus Experiment", though, which I think has a more interesting title.

Quote:

the spreadsheet that we saw wasn't even password-protected

Probably because very few competent IT folks are willing to work for law firms (high pressure, relatively low pay).

On the second point I have to agree. One of the groups issuing thousands of settlement letters about copyright infringement is now facing a multimillion dollar lawsuit for not protecting defendants personal information (aka credit card, bank account, and social security numbers from individuals that settled) as it was available on their public server unencrypted in plain text format (opening up about 10,000 individuals to potential identity theft and totally non-compliant with current IT laws).

I forget which law firm is tied up in this, but you can find the article on TorrentFreak.

One of the interesting points is how much they're paying the ISPs. Is this a backhander, maybe for not contesting the court orders or something?

Probably an agreed on rate, since it takes employee time away from other projects to do the lookups, cross-check the data, and then format it for passing to the law firm.

Does someone have to pay to get information that they've got a court order for? I don't know, but it seems odd. If you get a court order saying the ISP has to give you information, but you don't have the cash to pay them to give it to you, then the ISP gets off the hook? That doesn't seem very just.

And is the rate the ISP getting making them a profit? If they charge more than it costs them, isn't a conflict of interest created?

Is there a scenario where the ISP could say to the law firm: "We could contest your court order, but we won't. In return, you give us a percentage of your profits."?

If the ISPs are incentivized to participate in these scams, it might make some people reconsider whether they're trustworthy allies in the legal battles against egregious practices.

I don't know much about this issue except what I've read on Ars lately, but it's something that occurs to me.

BT itself is in contempt of court for even supplying that information via email. The High Court demanded it be supplied encrypted on a CDROM or equivalent medium. It wasn't encrypted and it was in open email.

One of the interesting points is how much they're paying the ISPs. Is this a backhander, maybe for not contesting the court orders or something?

Probably an agreed on rate, since it takes employee time away from other projects to do the lookups, cross-check the data, and then format it for passing to the law firm.

Does someone have to pay to get information that they've got a court order for? I don't know, but it seems odd. If you get a court order saying the ISP has to give you information, but you don't have the cash to pay them to give it to you, then the ISP gets off the hook? That doesn't seem very just.

From what I have read (mostly Ars Technica articles and their linked sources), there have been no lawsuits filed. No court orders have been given, just letters. I will assume (and hope) that a letter from an attorney saying "tell me who is associated with these IP addresses" doesn't hold any real clout when compared to an honest-to-FSM order from a judge.

One of the interesting points is how much they're paying the ISPs. Is this a backhander, maybe for not contesting the court orders or something?

Probably an agreed on rate, since it takes employee time away from other projects to do the lookups, cross-check the data, and then format it for passing to the law firm.

Does someone have to pay to get information that they've got a court order for? I don't know, but it seems odd. If you get a court order saying the ISP has to give you information, but you don't have the cash to pay them to give it to you, then the ISP gets off the hook? That doesn't seem very just.

From what I have read (mostly Ars Technica articles and their linked sources), there have been no lawsuits filed. No court orders have been given, just letters. I will assume (and hope) that a letter from an attorney saying "tell me who is associated with these IP addresses" doesn't hold any real clout when compared to an honest-to-FSM order from a judge.

Actually, there have been real suits. Most of which have been won by the so called file-sharers (evidence on Ars).

I notice that for the Evidenzia2 project, the average amount claimed is lower than the others.That's outrageous! That's devaluating the content! I bet the movies from that project might finally end up for rental on the AppleTV

In Denmark fashion companies are suing stores that sell fashion items that look anything remotely like theirs. Even if the stores win the cases are dragged out and more costly than a settlement. Stores are settling even when they are in the right. Legal blackmail as well.

Some stores even started selling the blackmailers items because they thought that was safer than cheaper alternatives. The lawyers make money. Blackmailers make money. We the sheep loose.

From what I have read (mostly Ars Technica articles and their linked sources), there have been no lawsuits filed. No court orders have been given, just letters. I will assume (and hope) that a letter from an attorney saying "tell me who is associated with these IP addresses" doesn't hold any real clout when compared to an honest-to-FSM order from a judge.

I believe ACS Law has to get a court order before the ISP will release the names and addresses for the IPs.

E.g. BT wrote to ACS Law:

"In accordance with the Court's Order of 17 February 2010 ("the Order"), please find enclosed the data in accordance with paragraph 1 of the Order. Please acknowledge safe receipt and that the data will be held securely and shall be used only in accordance with the provisions of the Order."

Edit: Seems providers are now cutting ACS Law off. So much for that business model. According to The Guardian "The Guardian understands that ISPs charge ACS:Law around £65 for an individual customer's information. Some broadband providers charge by the hour to supply customer data – some thought to be charging up to £500 per hour – while others fix prices to a per-customer basis." I guess the bad publicity suddenly made the profits seem too small!

This should not hold in court. There are no intellectual property laws for fashion, design of clothes. The only thing they can sue for is copying of trade marked logotypes. If the copy clothes omit the logos, there is no case.A fun lecture on this by Johanna Blakley on TED: http://www.ted.com/talks/johanna_blakle ... lture.html

"Does someone have to pay to get information that they've got a court order for? I don't know, but it seems odd. If you get a court order saying the ISP has to give you information, but you don't have the cash to pay them to give it to you, then the ISP gets off the hook? That doesn't seem very just."

In Sweden, where we got the new IPRED law a year and a half ago, any intellectual property holder can ask an ISP for names and addresses of a suspected copyright infringer. First day after the law was introduced, audio book owners asked an ISP for the name and address of an FTP site where their work could be downloaded (using accounts and passwords btw), but the ISP refused to hand out the information citing privacy laws. This has now gone through two court levels in Sweden and has ended with a paradox of laws, so that it will now be sent to EU court, to clarify if the new Swedish IPRED law is allowed in the EU framework. This is estimated to take at least 1-2 years, maybe up to 5.

Mujokan, it is not actually unreasonable for ISPs to be paid to provide IP addresses, there is a cost involved in providing them, thus they should be reimbursed for this. Using the first campaign listed (Digiprotect 3/4), assuming the 15% ISP rate, they are receiving 49p per IP, which probably doesn't actually cover the real cost. Now whether there should be a court process that must be followed before ISPs should give IPs over is another matter entirely

I really hope that the publicity coming from this law firm's extortion tactics will settle in the American mass consciousness such that people can realize that what the USCG is doing is the same thing. Naturally, that would require your Common Joe to read about such "dry" and non-celebrity-scandal laden articles as this to even know it's going on, and then they'd have to show enough foresight and logical abilities to link the actions of ACS with that of USCG (as far as methods go). So there's two major hurdles that will stop this from ever entering the awareness of the masses. But it sure would be nice for people to start realizing these shakedown attempts and cut off those that send out the letters trying to fish for easy money from potentially innocent people.

Of course they are. Most of the ISP's are just different on-paper entities of the major content providers. In some cases they aren't even differentiated by said paper (aka Time-Warner).

AFAIK that isn't the case in the UK, where most ISPs have little or no connection to major content providers. The only UK ISPs I can think of that do have such a connection are Virgin and Sky, and their customers have a wide range of other ISPs they could choose to switch to if they want.

It's so easy to spoof an IP, I love how these companies either don't know, or don't care that a good portion of their "clients" are probably telling the truth that they never downloaded anything. It's all about the money.

A couple things really stick out here. First of all how about paying a freaking living wage for your employees. This is exactly what is happening in the USA. All the wealth, in any given company, has now been consolidated at the top to the detriment of the rank and file.

As for this dumb-ass not safe guarding the private data (looks like he is a Luddite), his license should be pulled. Its one thing to have the right to sue on behalf of the copyright holders, its another to do it in a very unsafe method. I really hoped that there would be some house of lords and house of common politician in this list.

What would happen if say there was a spyware installed in these unsuspecting users PCs' that in fact did the click/download the these porno's. Its kind of the same as spyware/virus companies that actually do the install of said virus/spyware infections. You not only create the market but you benefit financially from your nefarious business practices. This is why its so important for due process and to NEVER bypass the judicial branch based on special interest groups like some EU countries have already done (or at the very least tried to do). If however you know you downloaded Granny F^&*, then pay up.

All the people being targeted by this (as well as the 4chan folks wailing on his server) could get together to destroy his personal life. His ISP account and computer? Hacked & virused. His personal info? Distributed to every unsavory entity, hello spam by the billion, marketing phone calls every minute. His financial info? Identity theft. Credit history & rating? LOL. Bank account? Drained. Car, house, everything? Repossessed. Police record? Every criminal act know to man.

Use technology to f*k people over, get it back in spades.

Of course, I'm not endorsing any of these actions, it's all theoretical.

@Mujokan: "Does someone have to pay to get information that they've got a court order for?"

IIRC (but not where I read it), it works like this: if a law enforcement agency requests it (ie. the Police), ISP has to provide it for free. If a private party requests it (with a court order, obviously), the ISP is allowed to ask for compensation.

I don't know if there's an explicit cap on how much the ISP can charge (probably not). In which case there's an interesting loophole here: the ISP can technically comply with the order, but ask for a totally unreasonable sum of money to perform the lookup, which would practically negate the troll's request. OFC the troll can then appeal to the court to fight this etc. ad nauseam.

@steviesteveo12: "There's more to know about this than just trademarks."

AFAIK no, there isn't.

There's trademark law, which protects specific marks (names or logos). If the copycat doesn't use or imitate the mark, they're safe.

There's copyright law, which protects intellectual works. Infringement occurs only when there's verbatim copy (and there are some exceptions). Obviously that's not the case with clothing.

There's patent law, which covers ways of doing something. It's not an issue if the end result is similar, patents only cover the process of getting there.

As you can see, there's nothing the original designer can use. His only defence is that people will actually want to buy the stuff with his mark on it. If they choose cheaper stuff that looks similar (or identical) but it's not the same quality and doesn't have the mark, there's nothing the designer can do.

@steviesteveo12: "There's more to know about this than just trademarks."

AFAIK no, there isn't.

There's trademark law, which protects specific marks (names or logos). If the copycat doesn't use or imitate the mark, they're safe.

There's copyright law, which protects intellectual works. Infringement occurs only when there's verbatim copy (and there are some exceptions). Obviously that's not the case with clothing.

There's patent law, which covers ways of doing something. It's not an issue if the end result is similar, patents only cover the process of getting there.

As you can see, there's nothing the original designer can use. His only defence is that people will actually want to buy the stuff with his mark on it. If they choose cheaper stuff that looks similar (or identical) but it's not the same quality and doesn't have the mark, there's nothing the designer can do.

To give one example of what else you've not mentioned right off the top of my head there's a thing called a registered Community design (RCD), they might not have it where you live which may be why you've not mentioned it but they certainly have it in Denmark where these cases happened. I don't want to be too technical but it's basically where you have a design for a product and you register it. It gives you rights in the design.